UN-3770 [MISC] Make list pagination consistent across shared resource endpoints

backend/adapter_processor_v2/migrations/0006_adapterinstance_adapter_org_modified_idx.py

@@ -0,0 +1,18 @@
+# Generated by Django 4.2.30 on 2026-07-30 09:07
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("adapter_processor_v2", "0005_absorb_shared_users"),
+    ]
+
+    operations = [
+        migrations.AddIndex(
+            model_name="adapterinstance",
+            index=models.Index(
+                fields=["organization", "-modified_at"], name="adapter_org_modified_idx"
+            ),
+        ),
+    ]

backend/adapter_processor_v2/models.py

@@ -51,15 +51,11 @@ def for_user(self, user: User) -> QuerySet[Any]:
         group_shared_ids = resources_visible_via_groups(self.model, user_group_ids)
         member_ids = resources_visible_via_memberships(self.model, user)
 
-        return (
-            self.get_queryset()
-            .filter(
-                models.Q(pk__in=member_ids)
-                | models.Q(shared_to_org=True)
-                | models.Q(is_friction_less=True)
-                | models.Q(pk__in=group_shared_ids)
-            )
-            .distinct("id")
+        return self.get_queryset().filter(
+            models.Q(pk__in=member_ids)
+            | models.Q(shared_to_org=True)
+            | models.Q(is_friction_less=True)
+            | models.Q(pk__in=group_shared_ids)
         )
 
 
@@ -172,6 +168,13 @@ class Meta:
                 name="unique_organization_adapter",
             ),
         ]
+        # Backs the default org-scoped `-modified_at, pk` list ordering.
+        indexes = [
+            models.Index(
+                fields=["organization", "-modified_at"],
+                name="adapter_org_modified_idx",
+            ),
+        ]
 
     def create_adapter(self) -> None:
         encryption_secret: str = settings.ENCRYPTION_KEY

backend/adapter_processor_v2/serializers.py

@@ -207,10 +207,14 @@ def to_representation(self, instance: AdapterInstance) -> dict[str, str]:
         if model:
             rep["model"] = model
 
+        # Frictionless (Unstract-provisioned) adapters mask the owner org-wide;
+        # mask owner_emails too, else the Owned By column leaks the real owner.
         if instance.is_friction_less:
             rep["created_by_email"] = "Unstract"
+            rep["owner_emails"] = ["Unstract"]
         else:
             rep["created_by_email"] = instance.created_by.email
+            rep["owner_emails"] = instance.owner_emails()
 
         request = self.context.get("request")
         rep["is_owner"] = instance.is_owner(request.user) if request else False

backend/adapter_processor_v2/views.py

@@ -148,6 +148,9 @@ class AdapterInstanceViewSet(
 ):
     serializer_class = AdapterInstanceSerializer
     pagination_class = OptionalPagination
+    # `pk` tiebreaker keeps paging deterministic when modified_at collides.
+    ordering = ["-modified_at", "pk"]
+    ordering_fields = ["adapter_name", "created_at", "modified_at"]
     notification_resource_name_field = "adapter_name"
 
     def get_notification_resource_type(self, resource: Any) -> str | None:
@@ -192,12 +195,17 @@ def get_queryset(self) -> QuerySet | None:
 
         search = self.request.query_params.get("search")
         if search:
-            queryset = queryset.filter(adapter_name__icontains=search)
+            from django.db.models import Q
+            from tenant_account_v2.sharing_helpers import (
+                resources_matching_owner_search,
+            )
+
+            queryset = queryset.filter(
+                Q(adapter_name__icontains=search)
+                | Q(pk__in=resources_matching_owner_search(queryset.model, search))
+            )
 
-        # Order by the DISTINCT ON field so pagination is deterministic and the
-        # admin/service branch (no distinct) is ordered too. Not modified_at:
-        # that would conflict with the DISTINCT ON in for_user().
-        return queryset.order_by("id")
+        return queryset
 
     def get_serializer_class(
         self,

backend/backend/settings/base.py

@@ -627,7 +627,7 @@ def filter(self, record):
     "DEFAULT_FILTER_BACKENDS": [
         "utils.filters.organization_filter.OrganizationFilterBackend",
         "django_filters.rest_framework.DjangoFilterBackend",
-        "rest_framework.filters.OrderingFilter",
+        "utils.filters.ordering_filter.DeterministicOrderingFilter",
     ],
     # For API versioning
     "DEFAULT_VERSIONING_CLASS": "rest_framework.versioning.URLPathVersioning",

backend/connector_v2/migrations/0008_connectorinstance_connector_org_modified_idx.py

@@ -0,0 +1,18 @@
+# Generated by Django 4.2.30 on 2026-07-30 09:07
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("connector_v2", "0007_absorb_shared_users"),
+    ]
+
+    operations = [
+        migrations.AddIndex(
+            model_name="connectorinstance",
+            index=models.Index(
+                fields=["organization", "-modified_at"], name="connector_org_modified_idx"
+            ),
+        ),
+    ]

backend/connector_v2/models.py

@@ -44,14 +44,10 @@ def for_user(self, user: User) -> models.QuerySet:
         group_shared_ids = resources_visible_via_groups(self.model, user_group_ids)
         member_ids = resources_visible_via_memberships(self.model, user)
 
-        return (
-            self.get_queryset()
-            .filter(
-                models.Q(pk__in=member_ids)
-                | models.Q(shared_to_org=True)
-                | models.Q(pk__in=group_shared_ids)
-            )
-            .distinct("id")
+        return self.get_queryset().filter(
+            models.Q(pk__in=member_ids)
+            | models.Q(shared_to_org=True)
+            | models.Q(pk__in=group_shared_ids)
         )
 
 
@@ -173,3 +169,10 @@ class Meta:
                 name="unique_organization_connector",
             ),
         ]
+        # Backs the default org-scoped `-modified_at, pk` list ordering.
+        indexes = [
+            models.Index(
+                fields=["organization", "-modified_at"],
+                name="connector_org_modified_idx",
+            ),
+        ]

backend/connector_v2/serializers.py

@@ -176,6 +176,7 @@ def to_representation(self, instance: ConnectorInstance) -> dict[str, str]:
         request = self.context.get("request")
         rep["is_owner"] = instance.is_owner(request.user) if request else False
         rep["co_owners_count"] = instance.co_owners_count()
+        rep["owner_emails"] = instance.owner_emails()
 
         return rep
 

backend/connector_v2/views.py

@@ -47,6 +47,9 @@ class ConnectorInstanceViewSet(
     versioning_class = URLPathVersioning
     serializer_class = ConnectorInstanceSerializer
     pagination_class = OptionalPagination
+    # `pk` tiebreaker keeps paging deterministic when modified_at collides.
+    ordering = ["-modified_at", "pk"]
+    ordering_fields = ["connector_name", "created_at", "modified_at"]
     notification_resource_name_field = "connector_name"
 
     def get_notification_resource_type(self, resource: Any) -> str | None:
@@ -105,10 +108,6 @@ def get_queryset(self) -> QuerySet | None:
         if filter_args:
             queryset = queryset.filter(**filter_args)
 
-        search = self.request.query_params.get("search")
-        if search:
-            queryset = queryset.filter(connector_name__icontains=search)
-
         # Filter by connector_mode
         connector_mode_param = self.request.query_params.get("connector_mode")
         if connector_mode_param:
@@ -127,10 +126,19 @@ def get_queryset(self) -> QuerySet | None:
                 )
                 queryset = queryset.none()
 
-        # Order by the DISTINCT ON field so pagination is deterministic and the
-        # admin/service branch (no distinct) is ordered too. Not modified_at:
-        # that would conflict with the DISTINCT ON in for_user().
-        return queryset.order_by("id")
+        search = self.request.query_params.get("search")
+        if search:
+            from django.db.models import Q
+            from tenant_account_v2.sharing_helpers import (
+                resources_matching_owner_search,
+            )
+
+            queryset = queryset.filter(
+                Q(connector_name__icontains=search)
+                | Q(pk__in=resources_matching_owner_search(queryset.model, search))
+            )
+
+        return queryset
 
     def _get_connector_metadata(self, connector_id: str) -> dict[str, str] | None:
         """Gets connector metadata for the ConnectorInstance.

backend/dashboard_metrics/views.py

@@ -14,11 +14,11 @@
 from rest_framework import status, viewsets
 from rest_framework.decorators import action
 from rest_framework.exceptions import PermissionDenied
-from rest_framework.filters import OrderingFilter
 from rest_framework.permissions import IsAuthenticated
 from rest_framework.request import Request
 from rest_framework.response import Response
 from rest_framework.throttling import UserRateThrottle
+from utils.filters.ordering_filter import DeterministicOrderingFilter
 from utils.user_context import UserContext
 
 from .cache import (
@@ -156,7 +156,7 @@ class DashboardMetricsViewSet(viewsets.ReadOnlyModelViewSet):
     permission_classes = [IsAuthenticated, IsOrganizationMember]
     throttle_classes = [MetricsRateThrottle]
     serializer_class = EventMetricsHourlySerializer
-    filter_backends = [DjangoFilterBackend, OrderingFilter]
+    filter_backends = [DjangoFilterBackend, DeterministicOrderingFilter]
     ordering_fields = ["timestamp", "metric_name", "metric_value"]
     ordering = ["-timestamp"]
 

backend/permissions/models.py

@@ -43,6 +43,32 @@ def co_owners_count(self) -> int:
             for m in self.memberships.all()  # type: ignore[attr-defined]
         )
 
+    def owner_email(self) -> str | None:
+        # "Owned By" email: earliest live OWNER. ``created_by`` is audit-only
+        # (UN-2202) and may differ from the owner. Reads prefetched
+        # ``memberships`` to stay query-free.
+        owners = [
+            m
+            for m in self.memberships.all()  # type: ignore[attr-defined]
+            if m.role == ResourceRole.OWNER and not m.user.is_service_account
+        ]
+        if not owners:
+            return None
+        # pk breaks created_at ties so the label is stable across requests.
+        return min(owners, key=lambda m: (m.created_at, m.pk)).user.email
+
+    def owner_emails(self) -> list[str]:
+        # Every live OWNER email, earliest-first (``owner_email`` is just the
+        # head). Backs the Owned By tooltip so all co-owners are named, not only
+        # the primary + a ``+N`` count. Reads prefetched ``memberships``.
+        owners = [
+            m
+            for m in self.memberships.all()  # type: ignore[attr-defined]
+            if m.role == ResourceRole.OWNER and not m.user.is_service_account
+        ]
+        owners.sort(key=lambda m: (m.created_at, m.pk))
+        return [m.user.email for m in owners]
+
     def is_owner(self, user: Any) -> bool:
         if user is None:
             return False

backend/pipeline_v2/views.py

@@ -16,11 +16,11 @@
 from plugins import get_plugin
 from rest_framework import serializers, status, viewsets
 from rest_framework.decorators import action
-from rest_framework.filters import OrderingFilter
 from rest_framework.request import Request
 from rest_framework.response import Response
 from rest_framework.versioning import URLPathVersioning
 from scheduler.helper import SchedulerHelper
+from utils.filters.ordering_filter import DeterministicOrderingFilter
 from utils.pagination import CustomPagination
 
 from pipeline_v2.constants import (
@@ -51,7 +51,7 @@ class PipelineViewSet(
     versioning_class = URLPathVersioning
     queryset = Pipeline.objects.all()
     pagination_class = CustomPagination
-    filter_backends = [OrderingFilter]
+    filter_backends = [DeterministicOrderingFilter]
     ordering_fields = ["created_at", "last_run_time", "pipeline_name", "run_count"]
     # Note: Default ordering with nulls_last is applied in get_queryset()
     # DRF's ordering attribute doesn't support nulls_last natively

backend/prompt_studio/prompt_studio_core_v2/migrations/0010_customtool_custtool_org_modified_idx.py

@@ -0,0 +1,18 @@
+# Generated by Django 4.2.30 on 2026-07-30 09:07
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("prompt_studio_core_v2", "0009_absorb_shared_users"),
+    ]
+
+    operations = [
+        migrations.AddIndex(
+            model_name="customtool",
+            index=models.Index(
+                fields=["organization", "-modified_at"], name="custtool_org_modified_idx"
+            ),
+        ),
+    ]

backend/prompt_studio/prompt_studio_core_v2/models.py

@@ -40,14 +40,10 @@ def for_user(self, user: User) -> QuerySet[Any]:
         group_shared_ids = resources_visible_via_groups(self.model, user_group_ids)
         member_ids = resources_visible_via_memberships(self.model, user)
 
-        return (
-            self.get_queryset()
-            .filter(
-                models.Q(pk__in=member_ids)
-                | models.Q(shared_to_org=True)
-                | models.Q(pk__in=group_shared_ids)
-            )
-            .distinct("tool_id")
+        return self.get_queryset().filter(
+            models.Q(pk__in=member_ids)
+            | models.Q(shared_to_org=True)
+            | models.Q(pk__in=group_shared_ids)
         )
 
 
@@ -226,3 +222,10 @@ class Meta:
                 name="unique_tool_name",
             ),
         ]
+        # Backs the default org-scoped `-modified_at, pk` list ordering.
+        indexes = [
+            models.Index(
+                fields=["organization", "-modified_at"],
+                name="custtool_org_modified_idx",
+            ),
+        ]

backend/prompt_studio/prompt_studio_core_v2/serializers.py

@@ -48,6 +48,7 @@ class CustomToolListSerializer(serializers.ModelSerializer):
     prompt_count = serializers.SerializerMethodField()
     is_owner = serializers.SerializerMethodField()
     co_owners_count = serializers.SerializerMethodField()
+    owner_emails = serializers.SerializerMethodField()
 
     class Meta:
         model = CustomTool
@@ -65,6 +66,7 @@ class Meta:
             "prompt_count",
             "is_owner",
             "co_owners_count",
+            "owner_emails",
         ]
 
     def get_created_by_email(self, instance):
@@ -77,6 +79,9 @@ def get_is_owner(self, instance) -> bool:
     def get_co_owners_count(self, instance) -> int:
         return instance.co_owners_count()
 
+    def get_owner_emails(self, instance) -> list[str]:
+        return instance.owner_emails()
+
     def get_prompt_count(self, instance):
         if hasattr(instance, "_prompt_count"):
             return instance._prompt_count or 0